f3e3a6f2b0aeae57ad66b689c703012439c83539dff35cb5a97765ded26ef1ac

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 20:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-28_208c79c8f1f78e243fff6956cfc790e0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 34.9MB
Sample260828-zahn4ataqa
SHA256 f3e3a6f2b0aeae57ad66b689c703012439c83539dff35cb5a97765ded26ef1ac
MD5 208c79c8f1f78e243fff6956cfc790e0
SHA1 fa081d7290b7997abaf37fb58abe070b1a1c5fbb
SHA512 2020b84a5d0a20720189d269c975a8b3401838200ff425c6c41fddc2c22c2d75c538defb02469dd8f6932085c2f13e3cf6bbfef6d2a64831311a9ad3da52917f
SSDEEP 49152:U+ES+Ep+ES+ES+Ee+ES+ES+ES+ES+ES+ES+ES+ES+ES+Ee+ES+ES+ES+ES+ES+Ex:kOU/jIEeQfoR/IuOFVjUu5m
TLSH
T175872A09F94344B1D92B51B04DCFD3BF8A60BB2583128DF7FA4ECB5B6923BA16438255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
252	svchost_CCAAAABBAACBCBBBCCAACCBABBACCCBABBABBAABCBBCBBCAABCBBBC.exe
2608	svchost_CCAAAABBAACBCBBBCCAACCBABBACCCBABBABBAABCBBCBBCAABCBBBC.exe
4436	svchost_BCABCBBABBCBAACABBAAAAABBACBACAAABBCBABACBBAACBCABACAAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CABBCBABABAAABBBBCCCBCBAACCBBABABBCACCBCBAACBBCCBBBBABBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCAAAABBAACBCBBBCCAACCBABBACCCBABBABBAABCBBCBBCAABCBBBC.exe"	2026-08-28_208c79c8f1f78e243fff6956cfc790e0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBBABCABCBAACABCBBABCACAAAAACABCBBCBACABAACCACBAABCABAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCABCBBABBCBAACABBAAAAABBACBACAAABBCBABACBBAACBCABACAAB.exe"	svchost_CCAAAABBAACBCBBBCCAACCBABBACCCBABBABBAABCBBCBBCAABCBBBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1704	sc.exe
2744	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4204	cmd.exe
2360	cmd.exe
4448	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-28_208c79c8f1f78e243fff6956cfc790e0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCAAAABBAACBCBBBCCAACCBABBACCCBABBABBAABCBBCBBCAABCBBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCABCBBABBCBAACABBAAAAABBACBACAAABBCBABACBBAACBCABACAAB.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4692	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
6008	2026-08-28_208c79c8f1f78e243fff6956cfc790e0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
6008	2026-08-28_208c79c8f1f78e243fff6956cfc790e0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
6008	2026-08-28_208c79c8f1f78e243fff6956cfc790e0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
6008	2026-08-28_208c79c8f1f78e243fff6956cfc790e0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
252	svchost_CCAAAABBAACBCBBBCCAACCBABBACCCBABBABBAABCBBCBBCAABCBBBC.exe
252	svchost_CCAAAABBAACBCBBBCCAACCBABBACCCBABBABBAABCBBCBBCAABCBBBC.exe
252	svchost_CCAAAABBAACBCBBBCCAACCBABBACCCBABBABBAABCBBCBBCAABCBBBC.exe
252	svchost_CCAAAABBAACBCBBBCCAACCBABBACCCBABBABBAABCBBCBBCAABCBBBC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	6008	2026-08-28_208c79c8f1f78e243fff6956cfc790e0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	252	svchost_CCAAAABBAACBCBBBCCAACCBABBACCCBABBABBAABCBBCBBCAABCBBBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6008 wrote to memory of 4204	6008	2026-08-28_208c79c8f1f78e243fff6956cfc790e0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	95
PID 4204 wrote to memory of 4692	4204	cmd.exe	97
PID 6008 wrote to memory of 2360	6008	2026-08-28_208c79c8f1f78e243fff6956cfc790e0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	100
PID 2360 wrote to memory of 2744	2360	cmd.exe	102
PID 6008 wrote to memory of 4448	6008	2026-08-28_208c79c8f1f78e243fff6956cfc790e0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	103
PID 4448 wrote to memory of 1704	4448	cmd.exe	105
PID 252 wrote to memory of 1444	252	svchost_CCAAAABBAACBCBBBCCAACCBABBACCCBABBABBAABCBBCBBCAABCBBBC.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-28_208c79c8f1f78e243fff6956cfc790e0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-28_208c79c8f1f78e243fff6956cfc790e0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCABBCACCCCABBAACBCCCACABAAACAABBBABCCBABCACBBCCAABBBCCCABACBCCCBAAABACBABCBCAACBBCABBBAABBAACACACBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAAABBAACBCBBBCCAACCBABBACCCBABBABBAABCBBCBBCAABCBBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4204
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCABBCACCCCABBAACBCCCACABAAACAABBBABCCBABCACBBCCAABBBCCCABACBCCCBAAABACBABCBCAACBBCABBBAABBAACACACBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAAABBAACBCBBBCCAACCBABBACCCBABBABBAABCBBCBBCAABCBBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCACBAACBBCCBACBBCBCBABCBBBBBAABACBBAAAABCABAABBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAAABBAACBCBBBCCAACCBABBACCCBABBABBAABCBBCBBCAABCBBBC.exe" start= auto displayName= "UserDataSvc_BCCACBAACBBCCBACBBCBCBABCBBBBBAABACBBAAAABCABAABBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCACBAACBBCCBACBBCBCBABCBBBBBAABACBBAAAABCABAABBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAAABBAACBCBBBCCAACCBABBACCCBABBABBAABCBBCBBCAABCBBBC.exe" start= auto displayName= "UserDataSvc_BCCACBAACBBCCBACBBCBCBABCBBBBBAABACBBAAAABCABAABBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2744
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCACBAACBBCCBACBBCBCBABCBBBBBAABACBBAAAABCABAABBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4448
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCACBAACBBCCBACBBCBCBABCBBBBBAABACBBAAAABCABAABBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1704

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAAABBAACBCBBBCCAACCBABBACCCBABBABBAABCBBCBBCAABCBBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAAABBAACBCBBBCCAACCBABBACCCBABBABBAABCBBCBBCAABCBBBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:252
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1444

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAAABBAACBCBBBCCAACCBABBACCCBABBABBAABCBBCBBCAABCBBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAAABBAACBCBBBCCAACCBABBACCCBABBABBAABCBBCBBCAABCBBBC.exe
1⤵
- Executes dropped EXE
PID:2608

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBBABBCBAACABBAAAAABBACBACAAABBCBABACBBAACBCABACAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBBABBCBAACABBAAAAABBACBACAAABBCBABACBBAACBCABACAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b6a124809b05ba3b1c3bf1d498079b11987bd21e3e5fec521a8d3d82829891e4
MD5 a110ebdcda9507f4dcb39bb148498cb3
SHA1 8f037b35f8ee219162961a9fbf3b6ffe28d65c40
SHA512 c167e157fad8577f69da8e86481b7819e53bafbe82d539c1027127244501cf9739a1b253ebc649f6e7054bf4267ea66fe0e75ef0f4f1ad80b98b2b32f28bb22d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e3b4d337810a45d23c2bd2b23e43c1d16640c23ccfb3d9b448b96d163e3ab589
MD5 d153671b7844815dc0f36a2b98eaae88
SHA1 3ba1108498d0799084e7c41d2e10fc4f9fce2f4f
SHA512 351bfda03d2cd8633eddd96ea7eae1457f558014ab13ae6f4fb38fb2a090e0c93e8c9bf332430aa0b87cca1d1dbcf1c694bef8459d9a63a48a2f215242ceb725
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 54c0bc5b5f88ea8658d7a232895c4e166e7cb1e5c49289d55cdb61e44949ba92
MD5 a568edf5a53f307560f9d121309042e6
SHA1 55f6b009b3df8a030b8e793c243240e38c3c7740
SHA512 9e02f53214356f72ddf31320e9a24d0ecb4c84a2f70021c3ae254f8354f317b4c4582eb3031d704fb5bcc697d526751e05707ce8dd8a6b747f61d61f9eb09220
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 96c1de3311a6bf0fdf5d8ac54b19307b24fe276a1419301b06d00f2f5fca646b
MD5 3f4a01a8cb01055a0dd103a6c172fdb1
SHA1 85f968312f4533a5837ddbfb07f7ea887e68615e
SHA512 3914d90f179449e5f64246a156b38fe81b268eec6d95f4e747b9cfee928b4ad44632888a2a64a938608ddd0867c19320d58a2388e42ef1e7f850ee766c1bd073
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c4504035497c00d04dd1c4d5fb8a34863c6794e08e45c202cf9458730d3a8d96
MD5 6227954f62bcc3f9b26f6f60d98b6fa2
SHA1 3a71bc88abb1f71a08e05f83789ba50397e25ebb
SHA512 0abe3e953708b4242d0167a1f4751fd30bd8af14b2301a03d810ab868f89a0c80cf2bd0a4198a0ae4b66a4b996653256b017da1c16300ce4ccea2bdf4afcc8d4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 97ebcc82b250efc27edd5c18b55a8d57f518a1a15f6523563629512799815871
MD5 6cf0cda7dbcec0941798173b5b75c903
SHA1 ff5425eccbf86957181cfeb2b1c7ede4dbe81340
SHA512 8dd46bb7c0ca7727f926735e33a54be08cb9bce824eff4297d93e5092a05e6858248f5ff924badbbde226fcc34c2ee4925728093490fdc322e251aae79286399
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 429ee257fbc9a77739ef039d825a414fec56fe5118ebdb101df316181a7b110f
MD5 f5a44d6dfd5194cee49e5303675a56ef
SHA1 cbaf6c7967fefd2af6d7dfd66035cf7af13d1d27
SHA512 d324a7d9d3bcc61e3c76a9e1ebd97b51f49fdcc1b6033ec17e4319ab05b12151dcbfdb510f90bb7a1b88284670cd97ed1e036899276cf2df5f272d89b8c26dfb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3533df0bd4dfe7631a77f27de04299e346d7423af55b4b6f649e7c2d371622a1
MD5 19f46a1c9d6d08bcbbbe767e08575b06
SHA1 0d304f4182b9206a3fc29630116e75a8c6bb9ad9
SHA512 fd1c40d0ab97443935ee31b4c726c0569b7742328b2e0f07c75651865dea37a3711a8e27f3388a5f4c0963b671301433e0de4a78e08239861933a0d157d13555
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b963c3968d850747a8db6c33da3ba4c478c92ec98e21996f1ff106cd82a6728f
MD5 bc5f1822c00874b811edcc11917eb220
SHA1 a3dad40760264cebec7981e38b9539fc13647c82
SHA512 13a18f49c083edfd2bcc34b88943d69c7a519dfacb1af71394c89a8e12703ce49b1c0ff245c1ec96e5deac27b4fb01caa57b68b935032f3bd75ac6983271a021
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5dc20e6332350a68f4429a50ff0cbd5ef6f818134da70cc74633820a6bd85bc0
MD5 b5b920a551ebb17d673e602171b716ea
SHA1 55e8f1fe4fee4123bbfeab252cb9b38d0cc9103f
SHA512 4e7d4bacfb1ab08e3e5a860a0717590d3fdecfc2c92b5b5666fc67d357e41764609444d70519afd2b4d264a2751bf87851398ab7e562dbf8a7987c282093c41e
MD5 SHA1 SHA512

Submit Download

svchost_CCAAAABBAACBCBBBCCAACCBABBACCCBABBABBAABCBBCBBCAABCBBBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAAABBAACBCBBBCCAACCBABBACCCBABBABBAABCBBCBBCAABCBBBC.exe
Size 34.9MB
SHA256 f3e3a6f2b0aeae57ad66b689c703012439c83539dff35cb5a97765ded26ef1ac
MD5 208c79c8f1f78e243fff6956cfc790e0
SHA1 fa081d7290b7997abaf37fb58abe070b1a1c5fbb
SHA512 2020b84a5d0a20720189d269c975a8b3401838200ff425c6c41fddc2c22c2d75c538defb02469dd8f6932085c2f13e3cf6bbfef6d2a64831311a9ad3da52917f
SSDEEP 49152:U+ES+Ep+ES+ES+Ee+ES+ES+ES+ES+ES+ES+ES+ES+ES+Ee+ES+ES+ES+ES+ES+Ex:kOU/jIEeQfoR/IuOFVjUu5m
TLSH
T175872A09F94344B1D92B51B04DCFD3BF8A60BB2583128DF7FA4ECB5B6923BA16438255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/252-97-0x00000000001E0000-0x0000000000201000-memory.dmp

Download

memory/252-32-0x00000000001E0000-0x0000000000201000-memory.dmp

Download

memory/252-71-0x00000000001E0000-0x0000000000201000-memory.dmp

Download

memory/252-50-0x00000000001E0000-0x0000000000201000-memory.dmp

Download

memory/2608-86-0x00000000001E0000-0x0000000000201000-memory.dmp

Download

memory/4436-89-0x00000000005E0000-0x0000000000601000-memory.dmp

Download

memory/6008-82-0x0000000000300000-0x0000000000321000-memory.dmp

Download

memory/6008-10-0x0000000000300000-0x0000000000321000-memory.dmp

Download

memory/6008-21-0x0000000000300000-0x0000000000321000-memory.dmp

Download

memory/6008-33-0x0000000000300000-0x0000000000321000-memory.dmp

Download

memory/6008-59-0x0000000000300000-0x0000000000321000-memory.dmp

Download